moai-cc-mcp-plugins

Configure MCP servers by defining their type (GitHub, filesystem, SQLite, Brave Search), setting OAuth scopes for permissions, whitelisting allowed paths, and storing secrets in environment variables. Validate the structure using MCP validation commands before deployment.

OAuth scopes restrict what an MCP plugin can access. Define scopes based on your integration's needs—GitHub requires repo access, filesystem plugins need path whitelisting, and external APIs require specific permission grants. The Skill enforces scope validation during setup.

Validate MCP plugins using the /mcp health check endpoint and plugin validation commands. These verify that your server configuration, OAuth settings, path whitelisting, and environment variables meet security and operational requirements before integration.

Yes, environment variables are the required method for storing secrets in MCP configurations. This approach keeps credentials out of configuration files and ensures secure handling of OAuth tokens, API keys, and other sensitive data.

MCP servers are the backend services (GitHub, filesystem, SQLite, Brave Search) that provide data and functionality. Plugins are integrations that connect those servers to Claude Code through OAuth scopes and permission controls. Both require validation and security configuration.

Yes, path whitelisting is a required security control for filesystem MCP servers. It restricts which directories and files the plugin can access, preventing unauthorized data exposure and ensuring operations stay within defined boundaries.